<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<title>Kerberos</title>
<link rel="stylesheet" type="text/css" href="../C.css">
<script type="text/javascript" src="../jquery.js"></script><script type="text/javascript" src="../jquery.syntax.js"></script><script type="text/javascript" src="../yelp.js"></script>
</head>
<body id="home">
<!--<script src="https://ssl.google-analytics.com/urchin.js" type="text/javascript"></script><script type="text/javascript">
        _uacct = "UA-1018242-8";
        urchinTracker();
      </script><script>
      function englishPageVersion() {
        var href = window.location.href;
        if (href.slice(-1) == "/") {
                window.location = "index.html.en";
        } else {
                window.location = href.replace(/\.html.*/, ".html.en");
        }
         return false;
      }
      function browserPreferredLanguage() {
        var href = window.location.href;
        if (href.slice(-1) == "/") {
                window.location = href;
        } else {
                window.location = href.replace(/\.html.*/, ".html");
        }
        return false;
      }
      </script>--><div id="container">
<div id="container-inner">
<div id="mothership"><ul>
<li><a href="https://partners.ubuntu.com">Partners</a></li>
<li><a href="https://www.ubuntu.com/support/community-support">Support</a></li>
<li><a href="https://community.ubuntu.com">Community</a></li>
<li><a href="https://www.ubuntu.com">Ubuntu.com</a></li>
</ul></div>
<div id="header">
<h1 id="ubuntu-header"><a href="https://help.ubuntu.com/">Ubuntu Documentation</a></h1>
<ul id="main-menu">
<li><a class="main-menu-item current" href="https://help.ubuntu.com/">Official Documentation</a></li>
<li><a href="https://help.ubuntu.com/community/CommunityHelpWiki">Community Help Wiki</a></li>
<li><a href="https://community.ubuntu.com/t/contribute/26">Contribute</a></li>
</ul>
</div>
<div id="menu-search"><div id="search-box">
<noscript><form action="https://www.google.com/cse" id="cse-search-box"><div>
<input type="hidden" name="cx" value="003883529982892832976:e2vwumte3fq"><input type="hidden" name="ie" value="UTF-8"><input type="text" name="q" size="21"><input type="submit" name="sa" value="Search">
</div></form></noscript><!--
<script>
                document.write('<form action="https://help.ubuntu.com/search.html" id="cse-search-box">');
                document.write('  <div>');
                document.write('    <input type="hidden" name="cof" value="FORID:9">');
                document.write('    <input type="hidden" name="cx" value="003883529982892832976:e2vwumte3fq">');
                document.write('    <input type="hidden" name="ie" value="UTF-8">');
                document.write('    <input type="text" name="q" size="21">');
                document.write('    <input type="submit" name="sa" value="Search">');
                document.write('  </div>');
                document.write('</form>');
              </script>-->
</div></div>
<div class="trails"><div class="trail">
<a href="https://help.ubuntu.com/18.04" class="trail">Ubuntu 18.04</a> » <a class="trail" href="../index.html" title="Ubuntu Server Guide">Ubuntu Server Guide</a> » <a class="trail" href="network-authentication.html" title="Network Authentication">Network Authentication</a> » </div></div>
<div id="cwt-content" class="clearfix content-area"><div id="page">
<div id="content">
<div class="links nextlinks">
<a class="nextlinks-prev" href="samba-ldap.html" title="Samba and LDAP">Previous</a><a class="nextlinks-next" href="kerberos-ldap.html" title="Kerberos and LDAP">Next</a>
</div>
<div class="hgroup"><h1 class="title">Kerberos</h1></div>
<div class="region">
<div class="contents">
<p class="para">
    <span class="app application">Kerberos</span> is a network authentication system based on the principal of a trusted third party.
    The other two parties being the user and the service the user wishes to authenticate to.  Not all services and applications
    can use Kerberos, but for those that can, it brings the network environment one step closer to being Single Sign On (SSO).
    </p>
<p class="para">
    This section covers installation and configuration of a Kerberos server, and some example client configurations.
    </p>
</div>
<div class="links sectionlinks" role="navigation"><ul>
<li class="links"><a class="xref" href="kerberos.html#kerberos-overview" title="Overview">Overview</a></li>
<li class="links"><a class="xref" href="kerberos.html#kerberos-server" title="Kerberos Server">Kerberos Server</a></li>
<li class="links"><a class="xref" href="kerberos.html#kerberos-secondary-kdc" title="Secondary KDC">Secondary KDC</a></li>
<li class="links"><a class="xref" href="kerberos.html#kerberos-linux-client" title="Kerberos Linux Client">Kerberos Linux Client</a></li>
<li class="links"><a class="xref" href="kerberos.html#kerberos-resources" title="Resources">Resources</a></li>
</ul></div>
<div class="sect2 sect" id="kerberos-overview"><div class="inner">
<div class="hgroup"><h2 class="title">Overview</h2></div>
<div class="region"><div class="contents">
<p class="para">
      If you are new to Kerberos there are a few terms that are good to understand before setting up a Kerberos server.  Most of the terms
      will relate to things you may be familiar with in other environments:
      </p>
<div class="list itemizedlist"><ul class="list itemizedlist">
<li class="list itemizedlist">
          <p class="para">
          <span class="em emphasis">Principal:</span> any users, computers, and services provided by servers need to be defined as Kerberos Principals.
          </p>
        </li>
<li class="list itemizedlist">
          <p class="para">
          <span class="em emphasis">Instances:</span> are used for service principals and special administrative principals.
          </p>
        </li>
<li class="list itemizedlist">
          <p class="para">
          <span class="em emphasis">Realms:</span> the unique realm of control provided by the Kerberos installation.  
	  Think of it as the domain or group your hosts and users belong to.
	  Convention dictates the realm should be in uppercase.
	  By default, ubuntu will use the DNS domain converted to 
          uppercase (EXAMPLE.COM) as the realm.
          </p>
        </li>
<li class="list itemizedlist">
          <p class="para">
          <span class="em emphasis">Key Distribution Center:</span> (KDC) consist of three parts, a database of all principals, the authentication server,
          and the ticket granting server.  For each realm there must be at least one KDC.
          </p>
        </li>
<li class="list itemizedlist">
          <p class="para">
          <span class="em emphasis">Ticket Granting Ticket:</span> issued by the Authentication Server (AS), the Ticket Granting Ticket (TGT) is encrypted in 
          the user's password which is known only to the user and the KDC.
          </p>
        </li>
<li class="list itemizedlist">
          <p class="para">
          <span class="em emphasis">Ticket Granting Server:</span> (TGS) issues service tickets to clients upon request.
          </p>
        </li>
<li class="list itemizedlist">
          <p class="para">
          <span class="em emphasis">Tickets:</span> confirm the identity of the two principals.  One principal being a user and the other a service requested by 
          the user.  Tickets establish an encryption key used for secure communication during the authenticated session.
          </p>
        </li>
<li class="list itemizedlist">
          <p class="para">
          <span class="em emphasis">Keytab Files:</span> are files extracted from the KDC principal database and contain the encryption key for a service or
          host.
          </p>
        </li>
</ul></div>
<p class="para">
      To put the pieces together, a Realm has at least one KDC, preferably more for redundancy, which contains a database of Principals.  When a 
      user principal logs into a workstation that is configured for Kerberos authentication, the KDC issues a Ticket Granting Ticket (TGT).  If the user
      supplied credentials match, the user is authenticated and can then request tickets for Kerberized services from the Ticket Granting Server
      (TGS).  The service tickets allow the user to authenticate to the service without entering another username and password.
      </p>
</div></div>
</div></div>
<div class="sect2 sect" id="kerberos-server"><div class="inner">
<div class="hgroup"><h2 class="title">Kerberos Server</h2></div>
<div class="region">
<div class="contents"></div>
<div class="sect3 sect" id="kerberos-server-installation"><div class="inner">
<div class="hgroup"><h3 class="title">Installation</h3></div>
<div class="region"><div class="contents">
<p class="para">
	For this discussion, we will create a MIT Kerberos domain with the 
	following features (edit them to fit your needs):
        </p>
<div class="list itemizedlist"><ul class="list itemizedlist">
<li class="list itemizedlist">
            <p class="para">
            <span class="em emphasis">Realm:</span> EXAMPLE.COM 
            </p>
          </li>
<li class="list itemizedlist">
            <p class="para">
            <span class="em emphasis">Primary KDC:</span> kdc01.example.com (192.168.0.1)
            </p>
          </li>
<li class="list itemizedlist">
            <p class="para">
            <span class="em emphasis">Secondary KDC:</span> kdc02.example.com (192.168.0.2)
            </p>
          </li>
<li class="list itemizedlist">
            <p class="para">
            <span class="em emphasis">User principal:</span> steve 
            </p>
          </li>
<li class="list itemizedlist">
            <p class="para">
            <span class="em emphasis">Admin principal:</span> steve/admin 
            </p>
          </li>
</ul></div>
<div class="note" title="Note"><div class="inner"><div class="region"><div class="contents"> 
          <p class="para">
          It is <span class="em emphasis">strongly</span> recommended that your
	  network-authenticated users have their uid in a different range 
	  (say, starting at 5000) than that of your local users. 
          </p>
        </div></div></div></div>
<p class="para"> 
        Before installing the Kerberos server a properly configured DNS server is needed for your domain.  Since the Kerberos Realm by 
        convention matches the domain name, this section uses the <span class="em emphasis">EXAMPLE.COM</span> domain configured in 
        <a class="xref" href="dns-configuration.html#dns-primarymaster-configuration" title="Primary Master">Primary Master</a> of the DNS documentation.  
        </p>
<p class="para">
        Also, Kerberos is a time sensitive protocol.  So if the local system time between a client machine and the server differs by
        more than five minutes (by default), the workstation will not be able to authenticate.  To correct the problem all hosts 
        should have their time synchronized using the same
	<span class="em emphasis">Network Time Protocol (NTP)</span> server.  For details
        on setting up NTP see <a class="xref" href="NTP.html" title="Time Synchronization">Time Synchronization</a>.
        </p>
<p class="para">
        The first step in creating a Kerberos Realm is to install the <span class="app application">krb5-kdc</span>  and 
        <span class="app application">krb5-admin-server</span> packages.  From a terminal enter:
        </p>
<div class="screen"><pre class="contents "><span class="cmd command">sudo apt install krb5-kdc krb5-admin-server</span>
</pre></div>
<p class="para">
        You will be asked at the end of the install to supply the hostname 
	for the Kerberos and Admin servers, which may or may not be the 
        same server, for the realm.
        </p>
<div class="note" title="Note"><div class="inner"><div class="region"><div class="contents">
          <p class="para">
          By default the realm is created from the KDC's domain name.
          </p>
        </div></div></div></div>
<p class="para">
        Next, create the new realm with the <span class="app application">kdb5_newrealm</span> utility:
        </p>
<div class="screen"><pre class="contents "><span class="cmd command">sudo krb5_newrealm</span>
</pre></div>
</div></div>
</div></div>
<div class="sect3 sect" id="kerberos-server-configuration"><div class="inner">
<div class="hgroup"><h3 class="title">Configuration</h3></div>
<div class="region"><div class="contents">
<p class="para">
        The questions asked during installation are used to configure the <span class="file filename">/etc/krb5.conf</span> file.  If you need to adjust 
        the Key Distribution Center (KDC) settings simply edit the file and restart the <span class="app application">krb5-kdc</span> daemon.
	If you need to reconfigure Kerberos from scratch, perhaps to change the realm name, you can do so by typing
        </p>
<div class="screen"><pre class="contents "><span class="cmd command">sudo dpkg-reconfigure krb5-kdc</span>
</pre></div>
<div class="steps"><div class="inner"><ol class="steps">
<li class="steps">

            <p class="para">
            Once the KDC is properly running, an admin user -- the
	    <span class="em emphasis">admin principal</span> -- is needed.  
	    It is recommended to use a different username from your everyday username.  
            Using the <span class="app application">kadmin.local</span> utility in a terminal prompt enter:
            </p>

<div class="screen"><pre class="contents "><span class="cmd command">sudo kadmin.local</span>
<span class="output computeroutput">Authenticating as principal root/admin@EXAMPLE.COM with password.
kadmin.local:</span><span class="input userinput"> addprinc steve/admin</span>
<span class="output computeroutput">WARNING: no policy specified for steve/admin@EXAMPLE.COM; defaulting to no policy
Enter password for principal "steve/admin@EXAMPLE.COM": 
Re-enter password for principal "steve/admin@EXAMPLE.COM": 
Principal "steve/admin@EXAMPLE.COM" created.
kadmin.local:</span><span class="input userinput"> quit</span>
</pre></div>

            <p class="para">
            In the above example <span class="em emphasis">steve</span> is the <span class="em emphasis">Principal</span>, 
            <span class="em emphasis">/admin</span> is an <span class="em emphasis">Instance</span>, and 
            <span class="em emphasis">@EXAMPLE.COM</span> signifies the realm.  The <span class="em emphasis">"every day"</span>
            Principal, 
	    a.k.a. the <span class="em emphasis">user principal</span>,
	    would be <span class="em emphasis">steve@EXAMPLE.COM</span>, and should have only normal user rights.            
            </p>

            <div class="note" title="Note"><div class="inner"><div class="region"><div class="contents">
              <p class="para">
              Replace <span class="em emphasis">EXAMPLE.COM</span> and <span class="em emphasis">steve</span> with your Realm and admin username.
              </p>
            </div></div></div></div>

          </li>
<li class="steps">
 
            <p class="para">
            Next, the new admin user needs to have the appropriate Access Control List (ACL) permissions.
            The permissions are configured in the <span class="file filename">/etc/krb5kdc/kadm5.acl</span> file:
            </p>

<div class="code"><pre class="contents ">steve/admin@EXAMPLE.COM        *
</pre></div>

            <p class="para">
            This entry grants <span class="em emphasis">steve/admin</span> the ability to perform any operation on all principals in the realm.
	    You can configure principals with more restrictive privileges,
	    which is convenient if you need an admin principal that junior 
	    staff can use
	    in Kerberos clients. Please see the 
	    <span class="em emphasis">kadm5.acl</span> man page for details.
            </p>

          </li>
<li class="steps">

            <p class="para">
            Now restart the <span class="app application">krb5-admin-server</span> for the new ACL to take affect:
            </p>

<div class="screen"><pre class="contents "><span class="cmd command">sudo systemctl restart krb5-admin-server.service</span>
</pre></div>

          </li>
<li class="steps">

            <p class="para">
            The new user principal can be tested using the <span class="app application">kinit utility</span>:
            </p>

<div class="screen"><pre class="contents "><span class="cmd command">kinit steve/admin</span>
<span class="output computeroutput">steve/admin@EXAMPLE.COM's Password:</span>
</pre></div>          

            <p class="para">
            After entering the password, use the <span class="app application">klist</span> utility to view information about the 
            Ticket Granting Ticket (TGT):
            </p>

<div class="screen"><pre class="contents "><span class="cmd command">klist</span>
<span class="output computeroutput">Credentials cache: FILE:/tmp/krb5cc_1000
        Principal: steve/admin@EXAMPLE.COM

  Issued           Expires          Principal
Jul 13 17:53:34  Jul 14 03:53:34  krbtgt/EXAMPLE.COM@EXAMPLE.COM</span>
</pre></div>

            <p class="para">
	    Where the cache filename <span class="file filename">krb5cc_1000</span> is 
	    composed of the prefix <span class="file filename">krb5cc_</span> and the user
	    id (uid), which in this case is <span class="file filename">1000</span>.
            You may need to add an entry into the 
	    <span class="file filename">/etc/hosts</span> for the KDC so the client can
	    find the KDC.  For example:
            </p>
            
<div class="code"><pre class="contents ">192.168.0.1   kdc01.example.com       kdc01
</pre></div>

            <p class="para">
            Replacing <span class="em emphasis">192.168.0.1</span> with the IP address of your KDC.  
	    This usually happens when you have a Kerberos realm encompassing 
	    different networks separated by routers.
            </p>

          </li>
<li class="steps">
          
            <p class="para">
	    The best way to allow clients to automatically
            determine the KDC for the Realm is using DNS SRV records.  Add the following to 
            <span class="file filename">/etc/named/db.example.com</span>:
            </p>

<div class="code"><pre class="contents ">_kerberos._udp.EXAMPLE.COM.     IN SRV 1  0 88  kdc01.example.com.
_kerberos._tcp.EXAMPLE.COM.     IN SRV 1  0 88  kdc01.example.com.
_kerberos._udp.EXAMPLE.COM.     IN SRV 10 0 88  kdc02.example.com. 
_kerberos._tcp.EXAMPLE.COM.     IN SRV 10 0 88  kdc02.example.com. 
_kerberos-adm._tcp.EXAMPLE.COM. IN SRV 1  0 749 kdc01.example.com.
_kpasswd._udp.EXAMPLE.COM.      IN SRV 1  0 464 kdc01.example.com.
</pre></div>

            <div class="note" title="Note"><div class="inner"><div class="region"><div class="contents">
              <p class="para">
              Replace <span class="em emphasis">EXAMPLE.COM</span>, <span class="em emphasis">kdc01</span>, and <span class="em emphasis">kdc02</span> with your 
              domain name, primary KDC, and secondary KDC.
              </p>
            </div></div></div></div>

            <p class="para">
            See <a class="xref" href="dns.html" title="Domain Name Service (DNS)">Domain Name Service (DNS)</a> for detailed instructions on setting up DNS.
            </p>

          </li>
</ol></div></div>
<p class="para">
        Your new Kerberos Realm is now ready to authenticate clients.
        </p>
</div></div>
</div></div>
</div>
</div></div>
<div class="sect2 sect" id="kerberos-secondary-kdc"><div class="inner">
<div class="hgroup"><h2 class="title">Secondary KDC</h2></div>
<div class="region"><div class="contents">
<p class="para">
      Once you have one Key Distribution Center (KDC) on your network, it is good practice to have a Secondary KDC in case the
      primary becomes unavailable. 
      Also, if you have Kerberos clients that are in different networks 
      (possibly separated by routers using NAT), it is wise to place a 
      secondary KDC in each of those networks.
      </p>
<div class="steps"><div class="inner"><ol class="steps">
<li class="steps">
        
        <p class="para">
        First, install the packages, and when asked for the Kerberos and Admin server names enter the name of the Primary KDC:        
        </p>

<div class="screen"><pre class="contents "><span class="cmd command">sudo apt install krb5-kdc krb5-admin-server</span>
</pre></div>

        </li>
<li class="steps">

        <p class="para">
        Once you have the packages installed, create the Secondary KDC's host principal.  From a terminal prompt, enter:
        </p>

<div class="screen"><pre class="contents "><span class="cmd command">kadmin -q "addprinc -randkey host/kdc02.example.com"</span>
</pre></div>
    
        <div class="note" title="Note"><div class="inner"><div class="region"><div class="contents">
          <p class="para">
          After, issuing any <span class="app application">kadmin</span> commands you will be prompted for your 
          <span class="em emphasis">username/admin@EXAMPLE.COM</span> principal password.
          </p>
        </div></div></div></div>
      
        </li>
<li class="steps">

          <p class="para">
          Extract the <span class="em emphasis">keytab</span> file:
          </p>

<div class="screen"><pre class="contents "><span class="cmd command">kadmin -q "ktadd -norandkey -k keytab.kdc02 host/kdc02.example.com"</span>
</pre></div>

        </li>
<li class="steps">

          <p class="para">
          There should now be a <span class="file filename">keytab.kdc02</span> in the current directory, move the file to 
          <span class="file filename">/etc/krb5.keytab</span>:
          </p>

<div class="screen"><pre class="contents "><span class="cmd command">sudo mv keytab.kdc02 /etc/krb5.keytab</span>
</pre></div>

          <div class="note" title="Note"><div class="inner"><div class="region"><div class="contents">
            <p class="para">
            If the path to the <span class="file filename">keytab.kdc02</span> file is different adjust accordingly. 
            </p>
          </div></div></div></div>

          <p class="para">
          Also, you can list the principals in a Keytab file, which can be useful when troubleshooting, using the 
          <span class="app application">klist</span> utility:
          </p>

<div class="screen"><pre class="contents "><span class="cmd command">sudo klist -k /etc/krb5.keytab</span>
</pre></div>

            <p class="para">
            The <span class="app application">-k</span> option indicates the file is a keytab file.
            </p>

        </li>
<li class="steps">

          <p class="para">
          Next, there needs to be a <span class="file filename">kpropd.acl</span> file on each KDC that lists all KDCs for the Realm.  For example, 
          on both primary and secondary KDC, create <span class="file filename">/etc/krb5kdc/kpropd.acl</span>:
          </p>

<div class="code"><pre class="contents ">host/kdc01.example.com@EXAMPLE.COM
host/kdc02.example.com@EXAMPLE.COM
</pre></div>

        </li>
<li class="steps">

          <p class="para">
          Create an empty database on the <span class="em emphasis">Secondary KDC</span>:
          </p>

<div class="screen"><pre class="contents "><span class="cmd command">sudo kdb5_util -s create</span>
</pre></div>

        </li>
<li class="steps">

          <p class="para">
          Now start the <span class="app application">kpropd</span> daemon, which listens for connections from the 
          <span class="app application">kprop</span> utility.  <span class="app application">kprop</span> is used to transfer 
          dump files:
          </p>

<div class="screen"><pre class="contents "><span class="cmd command">sudo kpropd -S</span>
</pre></div>
      
        </li>
<li class="steps">

          <p class="para">
          From a terminal on the <span class="em emphasis">Primary KDC</span>, create a dump file of the principal database:
          </p>

<div class="screen"><pre class="contents "><span class="cmd command">sudo kdb5_util dump /var/lib/krb5kdc/dump</span>
</pre></div>

        </li>
<li class="steps">

          <p class="para">
          Extract the Primary KDC's <span class="em emphasis">keytab</span> file and copy it to <span class="file filename">/etc/krb5.keytab</span>:
          </p>

<div class="screen"><pre class="contents "><span class="cmd command">kadmin -q "ktadd -k keytab.kdc01 host/kdc01.example.com"</span>
<span class="cmd command">sudo mv keytab.kdc01 /etc/krb5.keytab</span>
</pre></div>

          <div class="note" title="Note"><div class="inner"><div class="region"><div class="contents">
            <p class="para">
            Make sure there is a <span class="em emphasis">host</span> for <span class="em emphasis">kdc01.example.com</span> before extracting the Keytab.
            </p>
          </div></div></div></div>

        </li>
<li class="steps">

          <p class="para">
          Using the <span class="app application">kprop</span> utility push the database to the Secondary KDC:
          </p>

<div class="screen"><pre class="contents "><span class="cmd command">sudo kprop -r EXAMPLE.COM -f /var/lib/krb5kdc/dump kdc02.example.com</span>
</pre></div>

          <div class="note" title="Note"><div class="inner"><div class="region"><div class="contents">
            <p class="para">
            There should be a <span class="em emphasis">SUCCEEDED</span> message if the propagation worked.  If there is an error 
            message check <span class="file filename">/var/log/syslog</span> on the secondary KDC for more information.
            </p>
          </div></div></div></div>
      
          <p class="para">
          You may also want to create a <span class="app application">cron</span> job to periodically update the database on the Secondary KDC.  For 
          example, the following will push the database every hour (note the long line has been split to fit the format of this document):
          </p>

<div class="code"><pre class="contents "># m h  dom mon dow   command
0 * * * * /usr/sbin/kdb5_util dump /var/lib/krb5kdc/dump &amp;&amp; 
/usr/sbin/kprop -r EXAMPLE.COM -f /var/lib/krb5kdc/dump kdc02.example.com
</pre></div>
  
        </li>
<li class="steps">

          <p class="para">
          Back on the <span class="em emphasis">Secondary KDC</span>, create a <span class="em emphasis">stash</span> file to hold the Kerberos 
          master key:
          </p>

<div class="screen"><pre class="contents "><span class="cmd command">sudo kdb5_util stash</span>
</pre></div>

        </li>
<li class="steps">

          <p class="para">
          Finally, start the <span class="app application">krb5-kdc</span> daemon on the Secondary KDC:
          </p>

<div class="screen"><pre class="contents "><span class="cmd command">sudo systemctl start krb5-kdc.service</span>
</pre></div>

        </li>
</ol></div></div>
<p class="para">
      The <span class="em emphasis">Secondary KDC</span> should now be able to issue tickets for the Realm.  You can test this by stopping 
      the <span class="app application">krb5-kdc</span> daemon on the Primary KDC, then 
      by using <span class="app application">kinit</span> to request a ticket.
      If all goes well you should receive a ticket from the Secondary KDC.
      Otherwise, check <span class="file filename">/var/log/syslog</span> and
      <span class="file filename">/var/log/auth.log</span> in the Secondary KDC.
      </p>
</div></div>
</div></div>
<div class="sect2 sect" id="kerberos-linux-client"><div class="inner">
<div class="hgroup"><h2 class="title">Kerberos Linux Client</h2></div>
<div class="region">
<div class="contents"><p class="para">
      This section covers configuring a Linux system as a <span class="app application">Kerberos</span> client.  This will allow access
      to any kerberized services once a user has successfully logged into the system.
      </p></div>
<div class="sect3 sect" id="kerberos-client-installation"><div class="inner">
<div class="hgroup"><h3 class="title">Installation</h3></div>
<div class="region"><div class="contents">
<p class="para">
        In order to authenticate to a Kerberos Realm, the <span class="app application">krb5-user</span> and <span class="app application">libpam-krb5</span>
        packages are needed, along with a few others that are not strictly necessary but make life easier.  To install the packages 
        enter the following in a terminal prompt:
        </p>
<div class="screen"><pre class="contents "><span class="cmd command">sudo apt install krb5-user libpam-krb5 libpam-ccreds auth-client-config</span>
</pre></div>
<p class="para">
        The <span class="app application">auth-client-config</span> package allows simple configuration of PAM for authentication from multiple 
        sources, and the <span class="app application">libpam-ccreds</span> will cache authentication credentials allowing you to login in case the 
        Key Distribution Center (KDC) is unavailable.  This package is also useful for laptops that may authenticate using Kerberos while 
        on the corporate network, but will need to be accessed off the network as well.
        </p>
</div></div>
</div></div>
<div class="sect3 sect" id="kerberos-client-configuration"><div class="inner">
<div class="hgroup"><h3 class="title">Configuration</h3></div>
<div class="region"><div class="contents">
<p class="para">
        To configure the client in a terminal enter:
        </p>
<div class="screen"><pre class="contents "><span class="cmd command">sudo dpkg-reconfigure krb5-config</span>
</pre></div>
<p class="para">
        You will then be prompted to enter the name of the Kerberos Realm.  Also, if you don't have DNS configured with Kerberos 
        <span class="em emphasis">SRV</span> records, the menu will prompt you for the hostname of the Key Distribution Center (KDC) and 
        Realm Administration server.
        </p>
<p class="para">
        The <span class="app application">dpkg-reconfigure</span> adds entries to the <span class="file filename">/etc/krb5.conf</span> file for your Realm.
        You should have entries similar to the following:
        </p>
<div class="code"><pre class="contents ">[libdefaults]
        default_realm = EXAMPLE.COM
...
[realms]
        EXAMPLE.COM = {
                kdc = 192.168.0.1
                admin_server = 192.168.0.1
        }
</pre></div>
<div class="note" title="Note"><div class="inner"><div class="region"><div class="contents">
	  <p class="para">
	  If you set the uid of each of your network-authenticated users to 
	  start at 5000, as suggested in 
	  <a class="xref" href="kerberos.html#kerberos-server-installation" title="Installation">Installation</a>, you 
	  can then tell pam to only try to authenticate using Kerberos 
	  users with uid &gt; 5000:
	  </p>
<div class="screen"><pre class="contents "><span class="cmd command"># Kerberos should only be applied to ldap/kerberos users, not local ones.
for i in common-auth common-session common-account common-password; do
 sudo sed -i -r \ 
 -e 's/pam_krb5.so minimum_uid=1000/pam_krb5.so minimum_uid=5000/' \ 
 /etc/pam.d/$i 
done </span>
</pre></div>
	  <p class="para">
	  This will avoid being asked for the (non-existent) Kerberos 
	  password of a locally authenticated user when changing its 
	  password using <span class="cmd command">passwd</span>.
	  </p>
	</div></div></div></div>
<p class="para">
        You can test the configuration by requesting a ticket using the <span class="app application">kinit</span> utility.  For example:
        </p>
<div class="screen"><pre class="contents "><span class="cmd command">kinit steve@EXAMPLE.COM</span>
<span class="output computeroutput">Password for steve@EXAMPLE.COM:</span>
</pre></div>
<p class="para">
        When a ticket has been granted, the details can be viewed using <span class="app application">klist</span>:
        </p>
<div class="screen"><pre class="contents "><span class="cmd command">klist</span>
<span class="output computeroutput">Ticket cache: FILE:/tmp/krb5cc_1000
Default principal: steve@EXAMPLE.COM

Valid starting     Expires            Service principal
07/24/08 05:18:56  07/24/08 15:18:56  krbtgt/EXAMPLE.COM@EXAMPLE.COM
        renew until 07/25/08 05:18:57


Kerberos 4 ticket cache: /tmp/tkt1000
klist: You have no tickets cached</span>
</pre></div>
<p class="para">
        Next, use the <span class="app application">auth-client-config</span> to configure the <span class="app application">libpam-krb5</span> module
        to request a ticket during login:
        </p>
<div class="screen"><pre class="contents "><span class="cmd command">sudo auth-client-config -a -p kerberos_example</span>
</pre></div>
<p class="para">
        You will should now receive a ticket upon successful login authentication. 
        </p>
</div></div>
</div></div>
</div>
</div></div>
<div class="sect2 sect" id="kerberos-resources"><div class="inner">
<div class="hgroup"><h2 class="title">Resources</h2></div>
<div class="region"><div class="contents"><div class="list itemizedlist"><ul class="list itemizedlist">
<li class="list itemizedlist">
          <p class="para">
          For more information on MIT's version of Kerberos, see the <a href="http://web.mit.edu/Kerberos/" class="ulink" title="http://web.mit.edu/Kerberos/">MIT Kerberos</a> site.
          </p>
        </li>
<li class="list itemizedlist">
          <p class="para">
          The <a href="https://help.ubuntu.com/community/Kerberos" class="ulink" title="https://help.ubuntu.com/community/Kerberos">Ubuntu Wiki Kerberos</a> page has more details.
          </p>
        </li>
<li class="list itemizedlist">
          <p class="para">
          O'Reilly's <a href="http://oreilly.com/catalog/9780596004033/" class="ulink" title="http://oreilly.com/catalog/9780596004033/">Kerberos: The Definitive Guide</a> is a great reference when
          setting up Kerberos.
          </p>
        </li>
<li class="list itemizedlist">
          <p class="para">
          Also, feel free to stop by the <span class="em emphasis">#ubuntu-server</span> 
	  and <span class="em emphasis">#kerberos</span>
	  IRC channels on <a href="http://freenode.net/" class="ulink" title="http://freenode.net/">Freenode</a>  
          if you have Kerberos questions.
          </p>
        </li>
</ul></div></div></div>
</div></div>
</div>
<div class="links nextlinks">
<a class="nextlinks-prev" href="samba-ldap.html" title="Samba and LDAP">Previous</a><a class="nextlinks-next" href="kerberos-ldap.html" title="Kerberos and LDAP">Next</a>
</div>
<div class="clear"></div>
</div>
<div id="pagebottom"></div>
</div></div>
</div>
<div id="footer"><p>The material in this document is available under a free license, see <a href="https://help.ubuntu.com/legal.html">Legal</a> for details.<br>
          For information on contributing see the <a href="https://wiki.ubuntu.com/DocumentationTeam">Ubuntu Documentation Team wiki page</a>.
          To report errors in this serverguide documentation, <a href="https://bugs.launchpad.net/serverguide">file a bug report</a>.</p></div>
</div>
</body>
</html>
